Phase 0 · Foundation
Versioned migrations, Auth, six-role RBAC, RLS, immutable audit history, secure storage, and fail-closed provider contracts.
PHASES 0–16 · ACTIVE FOUNDATION
The commerce core underneath SERRA.
Customer commerce, controlled operations, analytics, attribution, admin security, and evidence-backed launch controls are deployed on the connected Supabase project.
01 · DELIVERY STATUS
What is built now
“Active” means deployed and advisor-checked. Live provider credentials and test customer identities remain separate launch gates.
Phase 1 · Catalog
Nine products, 76 variants, customer profiles, multiple saved addresses, catalog search, product detail, CMS, and wishlist foundations.
Phase 2 · Commerce
Persistent cart, authoritative checkout, atomic reservation, test payments, order history, progress, and branded invoices.
Phase 3 · Inventory
Supplier receiving, QC, Owner-only cost, batch history, approval, low-stock alerts, supplier returns, and stock adjustments.
Phase 4 · Stock opname
Category-wide blind counts, timestamp reconciliation, automatic ledger adjustment, restricted variance, alerts, history, and CSV export.
Phase 5 · Fulfillment
Picking, unit-level barcode packing, package dimensions, price-free slips, labels, verified resi handoff, delivery completion, and Owner rollback.
Phase 6 · Returns
Mandatory evidence, CS and Owner review, inbound deadlines, QC, same-product exchanges, proof-gated refunds, and customer progress.
Phase 7 · Promotions
Five promotion types, centralized pricing, targeting, stacking, My Vouchers, deterministic upsell messaging, and atomic voucher lifecycle.
Phase 8 · Loyalty
Pending and expiring point batches, retained-item earning, FIFO holds, reward redemption, physical reward stock, and expiry notifications.
Phase 9 · Referral
Stable codes, one-time attribution, first-order qualification, return-window release, anti-abuse holds, staff review, and two-party benefits.
Phase 10 · Wishlist & restock
Exact-variant saving, Quick Add, promotion alerts, one-shot restock subscriptions, demand trends, anonymized export, and Owner-only subscriber identity.
Phase 11 · Reviews & merchandising
Verified-purchase reviews, moderation, PDP ratings, human-approved badges, ranked homepage rails, and manual product pins.
Phase 12 · Bulk import & export
Template generation, whole-file validation, expiring commit tokens, atomic import, large-price review, immutable history, and product export.
Phase 13 · Analytics
Sales, product, customer, funnel, and inventory reporting with permission-scoped exports and production-order separation.
Phase 14 · Attribution
UTM and referrer capture, session-to-order binding, first and last touch reporting, campaign links, and privacy-safe retention.
Phase 15 · Admin hardening
Step-up controls, role review, approval separation, audit visibility, break-glass rules, and privileged-operation safeguards.
Phase 16 · Launch controls
Provider gates, recovery evidence, immutable readiness history, Owner release decision, and automatic expiry of stale evidence.
Security boundary
Customer data remains owner-scoped, staff modules are permission-scoped, evidence uploads are private, and browser clients use only the publishable key.
Staff UAT
Create reviewed staff identities, assign roles, and run receiving, packing, return-QC, exchange, and refund scenarios before operational use.
02 · ARCHITECTURE
Fail-closed by design
The browser receives only publishable configuration. Sensitive keys and authoritative transitions remain on trusted server paths.
01Customer & staff clientsPublishable key · authenticated session
↓
02API & provider boundaryEmail · WhatsApp · payment · shipping contracts
↓
03Supabase Auth + PostgresRLS · RBAC · explicit grants · audit
↓
04Protected data & filesOwned customer rows · scoped staff access · private evidence
03 · SECURITY CONTROLS
Foundation rules
These controls become the floor for every later commerce phase.
ControlImplementationVerification
Row isolationRLS and explicit grants across the connected Phase 0–16 schemaLive database check
Data APIAuto-exposure disabled; privileges granted explicitlyConfiguration check
Staff authorizationPermission lookup uses app-owned role assignmentsRole matrix tests
SecretsNo service key or provider credential in public configurationEnvironment check
Audit historyUpdate and delete operations are blocked by triggerMigration check
UploadsThree cloud buckets with owner path, MIME, size, and staff permission rulesIdentity test pending
PHASE 16 ACTIVE
Real customer and staff surfaces now sit on the controlled core
The storefront exposes saved addresses, exact-variant wishlist, rewards, vouchers, referrals, private-evidence returns, tracking, and notifications. Authorized staff can inspect live operational queues without bypassing database permissions.